Description
A flaw has been found in Freedesktop Poppler 26.07.0. Impacted is the function JBIG2Stream::rewind of the file poppler/JBIG2Stream.cc. This manipulation causes null pointer dereference. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 26.08.0 is recommended to address this issue. Patch name: 5e49250f13b0390edeb3f90eb4c02c9941f97067. Upgrading the affected component is advised.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Freedesktop | Poppler | 26.07.0 | 26.08.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | poppler | 26.07.0-3 | — |
| Debian 13 | poppler | No fix yet | — |
| Debian 12 | poppler | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | poppler | 26.01.0-2ubuntu0.2 | USN-8894-1 |
| Ubuntu 24.04 LTS | poppler | 24.02.0-1ubuntu9.10 | USN-8894-1 |
| Ubuntu 22.04 LTS | poppler | 22.02.0-2ubuntu0.14 | USN-8894-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | poppler | No fix yet | — |
| Ubuntu Pro 18.04 LTS | poppler | No fix yet | — |
| Ubuntu Pro 16.04 LTS | poppler | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | poppler +9 | 26.08.0-1.hum1 | RHSA-2026:58482 |
Advisories 3
- WID-SEC-2026-3454 poppler: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Nov 10, 2026
- USN-8894-1 poppler vulnerabilities Ubuntu Security Notices (USN) · Oct 8, 2026
- RHSA-2026:58482 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Sep 24, 2026
References
- VDB-406610 | Freedesktop Poppler JBIG2Stream.cc rewind null pointer dereference vdb-entry technical-description
- VDB-406610 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- CVE-2026-93312 | CVE Analysis and Report third-party-advisory
- Submit #942345 | freedesktop.org Poppler 26.07.0 NULL Pointer Dereference third-party-advisory
- https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1759 related
- https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2314 patch
- https://github.com/r1ck9-2q/cve_summit/blob/main/Null-pointer-offset-undefined-behavior-in-JBIG2Stream-rewind-JBIG2Stream.cc-1229.md exploit
- https://gitlab.freedesktop.org/poppler/poppler/-/commit/5e49250f13b0390edeb3f90eb4c02c9941f97067 broken-link patch